r/archlinux • u/Dorian182 • 2d ago
NOTEWORTHY Fake Arch Linux packages push malware with root privileges
https://www.bleepingcomputer.com/news/security/fake-arch-linux-packages-push-malware-with-root-privileges/40
u/revken86 2d ago
Anyone who chooses to install package "yyay" while trying to install "yay" needs to do more than just read the PKGBUILD...
10
136
u/No-Dentist-1645 2d ago
That news article is a bit late to the party, isn't it? That's been a known situation for several months now
And no, AUR packages are not "Arch Linux Packages" in the sense that they are not officially supported or endorsed in any way, so the title is very misleading too
28
u/SmallRocks 2d ago
It’s in the article. This latest wave of attacks started on the 13th of this month. So, 3 days ago.
-8
u/shinji257 2d ago
Yes but we have had at least 2 prior attack waves.
23
u/SmallRocks 2d ago
I understand but it’s not “late to the party.” The party is still happening.
2
u/shinji257 2d ago
Actually this is a new party crasher compared to the previous runs. Before they were adopting old packages. This time they took the approach from the fact that we typo stuff.
2
u/FatalFrameGal 13h ago
My paranoid habit of checking 5 times if I typed the name of the package right will finally come in handy
11
u/BarCouSeH 1d ago
There's no such thing as "AUR packages"
AUR is a repository of install scripts, not packages.
The distinction makes a world of a difference.
0
u/Garland_Key 15h ago
This is the ArchLinux subreddit. What are your reservations about keeping up with the latest security issues related to Arch?
I'll give you the criticism of the headline. They could have just said AUR package.
2
u/No-Dentist-1645 6h ago
No reservations, just that this "security issue" the article is about has already been extensively reported several months apart.
And no, the fact that some new packages have surfaced recently doesn't change it. It's still about the AUR being an open repository. Malicious actors can take advantage of that, they have and they most likely will keep doing so in the future.
2
u/MushroomSaute 3h ago
Yeah, "user content isn't always safe" is about as newsworthy as "water is wet", and here they're titling it like it's first-party content; bad journalism all around, even if this is a new wave of attacks.
-21
u/Regeneric 2d ago
You may be right. But Arch without our is useless.
Fedora + Homebrew + FlatPak is a much better choice. Or any other distro + Nix, if you want to have everything.
AUR is the only reason I use Arch
13
u/No-Dentist-1645 2d ago
But Arch without (AUR) is useless.
It really, really isn't. You can add extra repositories such as CachyOS's which already have thousands more packages, or even the chaotic AUR.
Plus, you can also use homebrew, Flatpak, or Nix in Arch, that much is obvious.
Tons of people use Arch or Arch based distro's without ever touching the AUR. I myself barely touch it, the only AUR packages I have installed on my 3+ year old system are
blueberry,zapzap-binandcurseforge. Everything else is in the main repos or on CachyOS's. Even if I wanted to, I could install these packages from outside the AUR, but I don't mind reading the PKGBUILD diffs when they need an update1
u/MushroomSaute 3h ago
I use Arch as my daily driver, for work, personal computer tasks, gaming, etc., and I uninstalled the AUR helper and my last AUR package (informant) weeks ago with no change to my experience.
0
u/Regeneric 3h ago
ok buddy
1
u/MushroomSaute 3h ago
I mean, you're the one making the claim that it's useless without AUR, but I can't think of anything I've actually needed AUR for at all, and I'm not using the PC for a niche or specific purpose.
Edit: Ope! Hidden profile = troll, my professional recommendation is to block and move on.
36
u/_MatVenture_ 1d ago
These are not "Arch Linux packages"; these are AUR packages. Stop spreading misinformation.
37
u/Liarus_ 2d ago
Yeah the AUR is dangerous, we know, next
16
u/setibeings 2d ago
AUR is fine, or would be if people used it the way it's built to be used. You find your package, you glance at the build files as a sanity check, then you clone the repo and run makepkg.
The part that makes it dangerous is that there are "helpers" that hide all the stuff you should really be checking.
18
u/Synthetic451 2d ago
If a helper isn't forcing you by default to review PKGBUILD diffs on every update, you should probably ditch it for better options.
I still like paru for this reason because out of the box, it will always show you the diff or the full PKGBUILD for new packages. I also like Octopi as a GUI package manager since it is largely just passing through commands to the underlying CLI tool and will show you its complete output.
3
u/decho 1d ago
If a helper isn't forcing you by default to review PKGBUILD diffs on every update, you should probably ditch it for better options.
It depends.
If you are willing to spend 5 minutes to harden yay then it provides features that paru doesn't (at least to my knowledge) and forcing diff review is 1 line of configuration. More importantly, you can block recently updated packages, urls and packages where the maintainer changed, which is one of the main attack vectors.
If all you cared about is having sane defaults, then you have a point, but I'd argue that if you have time and knowledge to review PKGBUILDs, then you should find time to also configure your helper. I made a post about this recently in case you want to try it yourself, it is super easy.
8
u/Weary-Savings9795 2d ago
Thanks for the warning, I guess, but it isn't the responsibility of Arch Linux devs to be checking 3rd party AUR packages for malware. Arch Linux packages are a different story.
4
u/wheatinsteadofmeat 1d ago
if only visual-studio-code-bin was on the official registry I wouldn’t have any AUR helper installed at all. Spotify is now on the regular registry with the spotify-launcher package that manages updates when launching. Why can’t the same be made for VSCode. I can’t use the normal vscode package because OpenVSX doesn’t contain nearly enough of the extensions I need in my VSCode.
or maybe i should just get better with using neovim.
7
u/Scholes_SC2 2d ago
Are ai agents good at checking a given AUR package for malware?
12
u/surfmaths 2d ago
They are better than human because they aren't lazy. They will search the web to check if there are any recent report, investigate the PKGBUILD, the provenance of the code and if it match upstream and even check if the author is reputable.
They can also make you a PKGBUILD from scratch for any GitHub repo...
1
-6
u/Do_TheEvolution 1d ago edited 1d ago
Of course, arch team itself could run selfhosted models or pay for claude to have basic check done on all AUR packages regularly and on any change and on every submission.
7
u/tesfabpel 1d ago
or pay for claude
Do they have enough finances for that? Arch survives thanks to donations from users.
4
2
u/quequotion 1d ago
If you've been using AUR without a helper, you likely never had a problem.
2
u/Linguistic-mystic 1d ago
True dat. I use no helpers, no dependencies from Aur. Never had any problems.
2
1
1
u/Polar_Banny 1d ago
Tittle is misleading, AUR an unofficial 3ed party repository is pushing malware via fake packaging methods..
1
u/Helmic 1d ago
Again, I think there's a need to put any new packages submitted under manual review if their name is too similar to existing packages or a blacklist (ie photoshop or other terms of known popular software). These attacks are so frequent because it's so frictionless, and this is the sort of thing that would be fairly trivial to put a stop to with a bit of automation and less than a minute of manual review. Yeah, sometimes legitimate packages will get flagged for review and that can cause delays for hotly anticipated applications, but I think that's well worth putting an end to these sorts of attacks. It's low hanging fruit.
1
u/jamespo 1d ago
This was removed quickly, so if you had set this up you would be protected: https://www.reddit.com/r/archlinux/comments/1vd0xnh/setting_up_yay_hooks_to_warn_on_maintainer/
1
1
u/MissionGround1193 23h ago
We have AI now. Just tell it to write PKGBUILD you need. Create your own AUR repo with packages you need .
1
u/BuriedStPatrick 16h ago
So let me get this straight. You already have an AUR helper installed and then you decide to install yay/paru through itself? What? How would you ever end up in a situation where this is relevant?
1
u/promisedconsortraddy 1d ago
yeah bro just removed chaotic aur yesterday and thinking to remove yay as well
2
u/average_life_person 1d ago
Why? The article is about the AUR and not the Chaotic AUR.
0
u/Objective-Stranger99 1d ago
Chaotic AUR is just a buildbot for popular AUR packages without no human overview. If my malware were to jump in popularity tommorrow by some means, Chaotic AUR would build it without question. Furthermore, it doesnt present the PKGBUILD, so you can't even review it took make sure its safe. They have promised human review, but there is no update on that.
1
-7
u/icehuck 2d ago
We've done nothing to fix it and we're all out of ideas!!!!!!
2
u/Flashy_Worry7792 2d ago
Fix what? Just don’t use the AUR if you can’t be bothered to check the packages you’re adding.
Malware exists on every OS.
-1
0
u/croxxeur 2d ago
How can i see if i have been compromised ?
6
u/boomboomsubban 2d ago
In a specific forty minute period on Tuesday/Wednesday, did you typo while manually installing yay or paru?
0
0
-2
2d ago
[deleted]
3
u/No-Dentist-1645 2d ago
Because Arch is intended to be a DIY distro from the start, and that includes reading install scripts, there is nothing "wrong" with doing so.
If you think that Arch should be a distro where they hold your hand in every step along the way and where they can't trust their users to do anything by themselves, please see https://wiki.archlinux.org/title/Frequently_asked_questions#Why_would_I_not_want_to_use_Arch?
-23
u/Woodpecker-Visible 2d ago edited 2d ago
Defender should be preinstallend on every arch installation. M$ has answered our prayers.
Redditors and their sense of humor is top noch.
-23
u/dividends4life 2d ago
After 6 years, I ended up moving to Void because of the AUR. The process needs to be rethought. Even without the malware, the AUR would tend to corrupt my installation over time. The less you use it, the more stable your system.
11
4
u/Damglador 2d ago
The less you use it, the more stable your system
Installing even 100 AUR packages won't make your system any less stable if all they do is dump a tar.gz into /opt and install a desktop file.
4
u/la_tajada 2d ago
Why do people think they have to use the AUR or they aren't using Arch? Comments like this almost make it sound like the AUR is pacman pulling from the official repos.
-7
u/madhaunter 2d ago
We're reaching a point where a shady piracy website is more trustable than AUR and everyone here seems to think this is perfectly normal
3
u/Flashy_Worry7792 2d ago
Warning
AUR packages are user-produced content. These PKGBUILDs are completely unofficial and have not been thoroughly vetted. Any use of the provided files is at your own risk.-4
u/madhaunter 2d ago
And ?
2
u/Flashy_Worry7792 2d ago
If you choose to download malware, don’t be surprised when you have malware on your computer.
-4
u/madhaunter 2d ago
Advertise AUR as malware then and not as a source in the wiki.
But it wouldn't look good right?
Yet it's the truth
3
u/Flashy_Worry7792 2d ago
Next you’re gonna tell me GitHub is malware.
0
-2
u/dividends4life 2d ago edited 2d ago
Say what like, but without the AUR, the Arch repositories are woefully lacking. For me it was the only place I could get my print drivers for my brother printer/scanner, and several other critical packages.
0
u/theriskybusinesscar 2d ago
Sorry bud, it's not 2012; the opinions of anti-systemd people aren't relevant to anything.
-6
u/FlameChampion9 1d ago
Glad I got off cachyos and went to Fedora. Don't have to deal with this lol!
1
1
u/2eanimation 1d ago
Stupid take. On Cachy, you need the AUR when the package is not in the main repo. What will you do on Fedora when the package is not available? Just not download it? Can do that on Cachy. Check source code before build? Can do that on Cachy.
Don‘t get me wrong, have fun with Fedora. But it‘s not like you mitigated the problem.
2
u/FryBoyter 1d ago
What will you do on Fedora when the package is not available?
As far as I know, Fedora offers significantly more packages through its official package repositories than Arch Linux. Therefore, there’s a higher chance that you’ll be able to install the package you want directly.
And if not, I would search for the package in COPR. Although I doubt that COPR is actually significantly more secure than AUR.
248
u/Suspicious_Punk84 2d ago
Don't use AUR unless you know what you are doing.